Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-84206

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator deletions and bypass intended permission separation.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 30.5%
CVSS Severity
CVSS v3 Score 4.3
Products affected by CVE-2026-84206


Contact Us

Shodan ® - All rights reserved